Remote Access Challenge: Norway Protects Buses Against Cyber Risks

Norwegian public transport provider Ruter has introduced enhanced cybersecurity measures after tests showed that Chinese bus maker Yutong Group has the capability to remotely disable its electric buses. These results,

, highlight increasing international worries about the security risks of connected vehicles and have led Ruter to adopt more rigorous purchasing criteria and sophisticated anti-hacking protections.

During the tests, which took place in isolated settings like underground mines to prevent outside interference, Yutong’s latest electric buses were evaluated alongside three-year-old Dutch VDL models. Unlike the VDL buses, which do not support remote software updates, Yutong’s vehicles allow direct digital connectivity for diagnostics and updates,

. Ruter pointed out that this level of access "could, in theory, be misused to interfere with the bus," though there have been no reports of such incidents, .

Yutong, which has delivered tens of thousands of buses worldwide, responded via The Guardian, saying it "fully adheres" to local regulations and keeps bus data stored in Germany. An unnamed company representative also stated that all data is encrypted and used exclusively for service and performance improvements. Despite this, Ruter noted that the manufacturer

to essential systems, such as battery and power management, which raises the risk of the buses being rendered unusable.

Ruter, which manages half of Norway’s public transportation, is now installing firewalls to guarantee local oversight, postponing incoming software updates for review before installation, and working with authorities to define robust cybersecurity standards. These actions come amid a broader international focus on the security of remote vehicle technologies, including U.S. probes into Tesla’s app-based features.

The research highlights broader concerns about data protection and digital monitoring, especially as both governments and businesses emphasize safeguarding consumers. Ruter’s CEO, Bernt Reitan Jenssen, remarked that the tests moved the company from hypothetical worries to concrete security initiatives. Although Yutong’s buses are not self-driving, the possibility of remotely controlling power systems remains a significant risk.

This situation also brings attention to the geopolitical issues tied to technology supply chains. Yutong’s extensive reach across Europe, Africa, and the Asia-Pacific region has attracted attention amid ongoing debates about integrating foreign technology into vital infrastructure. Norway’s actions reflect a worldwide movement to strengthen cybersecurity regulations for connected devices, from 5G networks to public transportation.

---